book-extract

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime LLM context is fed from the converted EPUB’s XHTML/NCX-derived text (chapter Markdown written to cache/markdown/<book>/NN-*.md and then read by downstream steps); since the EPUB content is outsider-authored (not the operating user’s), this is an indirect prompt-injection path via book text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The install script (scripts/install_pandoc.sh) fetches and extracts a pandoc binary at runtime from GitHub (calls https://api.github.com/repos/jgm/pandoc/releases/latest and downloads from URLs like https://github.com/jgm/pandoc/releases/download/${VERSION}/...), which downloads and installs/executest a remote binary that the converter may rely on.